vendor/symfony/security-bundle/DependencyInjection/MainConfiguration.php line 73

  1. <?php
  3. /*
  4.  * This file is part of the Symfony package.
  5.  *
  6.  * (c) Fabien Potencier <fabien@symfony.com>
  7.  *
  8.  * For the full copyright and license information, please view the LICENSE
  9.  * file that was distributed with this source code.
  10.  */
  12. namespace Symfony\Bundle\SecurityBundle\DependencyInjection;
  14. use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\AbstractFactory;
  15. use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\AuthenticatorFactoryInterface;
  16. use Symfony\Component\Config\Definition\Builder\ArrayNodeDefinition;
  17. use Symfony\Component\Config\Definition\Builder\TreeBuilder;
  18. use Symfony\Component\Config\Definition\ConfigurationInterface;
  19. use Symfony\Component\Config\Definition\Exception\InvalidConfigurationException;
  20. use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface;
  21. use Symfony\Component\Security\Http\Session\SessionAuthenticationStrategy;
  23. /**
  24.  * SecurityExtension configuration structure.
  25.  *
  26.  * @author Johannes M. Schmitt <schmittjoh@gmail.com>
  27.  */
  28. class MainConfiguration implements ConfigurationInterface
  29. {
  30.     /** @internal */
  31.     public const STRATEGY_AFFIRMATIVE = 'affirmative';
  32.     /** @internal */
  33.     public const STRATEGY_CONSENSUS = 'consensus';
  34.     /** @internal */
  35.     public const STRATEGY_UNANIMOUS = 'unanimous';
  36.     /** @internal */
  37.     public const STRATEGY_PRIORITY = 'priority';
  39.     private array $factories;
  40.     private array $userProviderFactories;
  42.     /**
  43.      * @param array<AuthenticatorFactoryInterface> $factories
  44.      */
  45.     public function __construct(array $factories, array $userProviderFactories)
  46.     {
  47.         $this->factories = $factories;
  48.         $this->userProviderFactories = $userProviderFactories;
  49.     }
  51.     /**
  52.      * Generates the configuration tree builder.
  53.      */
  54.     public function getConfigTreeBuilder(): TreeBuilder
  55.     {
  56.         $tb = new TreeBuilder('security');
  57.         $rootNode = $tb->getRootNode();
  59.         $rootNode
  60.             ->children()
  61.                 ->scalarNode('access_denied_url')->defaultNull()->example('/foo/error403')->end()
  62.                 ->enumNode('session_fixation_strategy')
  63.                     ->values([SessionAuthenticationStrategy::NONE, SessionAuthenticationStrategy::MIGRATE, SessionAuthenticationStrategy::INVALIDATE])
  64.                     ->defaultValue(SessionAuthenticationStrategy::MIGRATE)
  65.                 ->end()
  66.                 ->booleanNode('hide_user_not_found')->defaultTrue()->end()
  67.                 ->booleanNode('erase_credentials')->defaultTrue()->end()
  68.                 ->booleanNode('enable_authenticator_manager')->setDeprecated('symfony/security-bundle', '6.2', 'The "%node%" option at "%path%" is deprecated.')->defaultTrue()->end()
  69.                 ->arrayNode('access_decision_manager')
  70.                     ->addDefaultsIfNotSet()
  71.                     ->children()
  72.                         ->enumNode('strategy')
  73.                             ->values($this->getAccessDecisionStrategies())
  74.                         ->end()
  75.                         ->scalarNode('service')->end()
  76.                         ->scalarNode('strategy_service')->end()
  77.                         ->booleanNode('allow_if_all_abstain')->defaultFalse()->end()
  78.                         ->booleanNode('allow_if_equal_granted_denied')->defaultTrue()->end()
  79.                     ->end()
  80.                     ->validate()
  81.                         ->ifTrue(fn ($v) => isset($v['strategy'], $v['service']))
  82.                         ->thenInvalid('"strategy" and "service" cannot be used together.')
  83.                     ->end()
  84.                     ->validate()
  85.                         ->ifTrue(fn ($v) => isset($v['strategy'], $v['strategy_service']))
  86.                         ->thenInvalid('"strategy" and "strategy_service" cannot be used together.')
  87.                     ->end()
  88.                     ->validate()
  89.                         ->ifTrue(fn ($v) => isset($v['service'], $v['strategy_service']))
  90.                         ->thenInvalid('"service" and "strategy_service" cannot be used together.')
  91.                     ->end()
  92.                 ->end()
  93.             ->end()
  94.         ;
  96.         $this->addPasswordHashersSection($rootNode);
  97.         $this->addProvidersSection($rootNode);
  98.         $this->addFirewallsSection($rootNode, $this->factories);
  99.         $this->addAccessControlSection($rootNode);
  100.         $this->addRoleHierarchySection($rootNode);
  102.         return $tb;
  103.     }
  105.     private function addRoleHierarchySection(ArrayNodeDefinition $rootNode): void
  106.     {
  107.         $rootNode
  108.             ->fixXmlConfig('role', 'role_hierarchy')
  109.             ->children()
  110.                 ->arrayNode('role_hierarchy')
  111.                     ->useAttributeAsKey('id')
  112.                     ->prototype('array')
  113.                         ->performNoDeepMerging()
  114.                         ->beforeNormalization()->ifString()->then(fn ($v) => ['value' => $v])->end()
  115.                         ->beforeNormalization()
  116.                             ->ifTrue(fn ($v) => \is_array($v) && isset($v['value']))
  117.                             ->then(fn ($v) => preg_split('/\s*,\s*/', $v['value']))
  118.                         ->end()
  119.                         ->prototype('scalar')->end()
  120.                     ->end()
  121.                 ->end()
  122.             ->end()
  123.         ;
  124.     }
  126.     private function addAccessControlSection(ArrayNodeDefinition $rootNode): void
  127.     {
  128.         $rootNode
  129.             ->fixXmlConfig('rule', 'access_control')
  130.             ->children()
  131.                 ->arrayNode('access_control')
  132.                     ->cannotBeOverwritten()
  133.                     ->prototype('array')
  134.                         ->fixXmlConfig('ip')
  135.                         ->fixXmlConfig('method')
  136.                         ->fixXmlConfig('attribute')
  137.                         ->children()
  138.                             ->scalarNode('request_matcher')->defaultNull()->end()
  139.                             ->scalarNode('requires_channel')->defaultNull()->end()
  140.                             ->scalarNode('path')
  141.                                 ->defaultNull()
  142.                                 ->info('use the urldecoded format')
  143.                                 ->example('^/path to resource/')
  144.                             ->end()
  145.                             ->scalarNode('host')->defaultNull()->end()
  146.                             ->integerNode('port')->defaultNull()->end()
  147.                             ->arrayNode('ips')
  148.                                 ->beforeNormalization()->ifString()->then(fn ($v) => [$v])->end()
  149.                                 ->prototype('scalar')->end()
  150.                             ->end()
  151.                             ->arrayNode('attributes')
  152.                                 ->useAttributeAsKey('key')
  153.                                 ->prototype('scalar')->end()
  154.                             ->end()
  155.                             ->scalarNode('route')->defaultNull()->end()
  156.                             ->arrayNode('methods')
  157.                                 ->beforeNormalization()->ifString()->then(fn ($v) => preg_split('/\s*,\s*/', $v))->end()
  158.                                 ->prototype('scalar')->end()
  159.                             ->end()
  160.                             ->scalarNode('allow_if')->defaultNull()->end()
  161.                         ->end()
  162.                         ->fixXmlConfig('role')
  163.                         ->children()
  164.                             ->arrayNode('roles')
  165.                                 ->beforeNormalization()->ifString()->then(fn ($v) => preg_split('/\s*,\s*/', $v))->end()
  166.                                 ->prototype('scalar')->end()
  167.                             ->end()
  168.                         ->end()
  169.                     ->end()
  170.                 ->end()
  171.             ->end()
  172.         ;
  173.     }
  175.     /**
  176.      * @param array<AuthenticatorFactoryInterface> $factories
  177.      */
  178.     private function addFirewallsSection(ArrayNodeDefinition $rootNode, array $factories): void
  179.     {
  180.         $firewallNodeBuilder = $rootNode
  181.             ->fixXmlConfig('firewall')
  182.             ->children()
  183.                 ->arrayNode('firewalls')
  184.                     ->isRequired()
  185.                     ->requiresAtLeastOneElement()
  186.                     ->disallowNewKeysInSubsequentConfigs()
  187.                     ->useAttributeAsKey('name')
  188.                     ->prototype('array')
  189.                         ->fixXmlConfig('required_badge')
  190.                         ->children()
  191.         ;
  193.         $firewallNodeBuilder
  194.             ->scalarNode('pattern')
  195.                 ->beforeNormalization()
  196.                     ->ifArray()
  197.                     ->then(fn ($v) => sprintf('(?:%s)', implode('|', $v)))
  198.                 ->end()
  199.             ->end()
  200.             ->scalarNode('host')->end()
  201.             ->arrayNode('methods')
  202.                 ->beforeNormalization()->ifString()->then(fn ($v) => preg_split('/\s*,\s*/', $v))->end()
  203.                 ->prototype('scalar')->end()
  204.             ->end()
  205.             ->booleanNode('security')->defaultTrue()->end()
  206.             ->scalarNode('user_checker')
  207.                 ->defaultValue('security.user_checker')
  208.                 ->treatNullLike('security.user_checker')
  209.                 ->info('The UserChecker to use when authenticating users in this firewall.')
  210.             ->end()
  211.             ->scalarNode('request_matcher')->end()
  212.             ->scalarNode('access_denied_url')->end()
  213.             ->scalarNode('access_denied_handler')->end()
  214.             ->scalarNode('entry_point')
  215.                 ->info(sprintf('An enabled authenticator name or a service id that implements "%s"', AuthenticationEntryPointInterface::class))
  216.             ->end()
  217.             ->scalarNode('provider')->end()
  218.             ->booleanNode('stateless')->defaultFalse()->end()
  219.             ->booleanNode('lazy')->defaultFalse()->end()
  220.             ->scalarNode('context')->cannotBeEmpty()->end()
  221.             ->arrayNode('logout')
  222.                 ->treatTrueLike([])
  223.                 ->canBeUnset()
  224.                 ->beforeNormalization()
  225.                     ->ifTrue(fn ($v): bool => isset($v['csrf_token_generator']) && !isset($v['csrf_token_manager']))
  226.                     ->then(function (array $v): array {
  227.                         $v['csrf_token_manager'] = $v['csrf_token_generator'];
  229.                         return $v;
  230.                     })
  231.                 ->end()
  232.                 ->beforeNormalization()
  233.                     ->ifTrue(fn ($v): bool => \is_array($v) && (isset($v['csrf_token_manager']) xor isset($v['enable_csrf'])))
  234.                     ->then(function (array $v): array {
  235.                         if (isset($v['csrf_token_manager'])) {
  236.                             $v['enable_csrf'] = true;
  237.                         } elseif ($v['enable_csrf']) {
  238.                             $v['csrf_token_manager'] = 'security.csrf.token_manager';
  239.                         }
  241.                         return $v;
  242.                     })
  243.                 ->end()
  244.                 ->children()
  245.                     ->booleanNode('enable_csrf')->defaultNull()->end()
  246.                     ->scalarNode('csrf_token_id')->defaultValue('logout')->end()
  247.                     ->scalarNode('csrf_parameter')->defaultValue('_csrf_token')->end()
  248.                     ->scalarNode('csrf_token_generator')
  249.                         ->setDeprecated(
  250.                             'symfony/security-bundle',
  251.                             '6.3',
  252.                             'The "%node%" option is deprecated. Use "csrf_token_manager" instead.'
  253.                         )
  254.                     ->end()
  255.                     ->scalarNode('csrf_token_manager')->end()
  256.                     ->scalarNode('path')->defaultValue('/logout')->end()
  257.                     ->scalarNode('target')->defaultValue('/')->end()
  258.                     ->booleanNode('invalidate_session')->defaultTrue()->end()
  259.                     ->arrayNode('clear_site_data')
  260.                         ->performNoDeepMerging()
  261.                         ->beforeNormalization()->ifString()->then(fn ($v) => $v ? array_map('trim', explode(',', $v)) : [])->end()
  262.                         ->enumPrototype()
  263.                             ->values([
  264.                                 '*', 'cache', 'cookies', 'storage', 'executionContexts',
  265.                             ])
  266.                         ->end()
  267.                     ->end()
  268.                 ->end()
  269.                 ->fixXmlConfig('delete_cookie')
  270.                 ->children()
  271.                     ->arrayNode('delete_cookies')
  272.                         ->normalizeKeys(false)
  273.                         ->beforeNormalization()
  274.                             ->ifTrue(fn ($v) => \is_array($v) && \is_int(key($v)))
  275.                             ->then(fn ($v) => array_map(fn ($v) => ['name' => $v], $v))
  276.                         ->end()
  277.                         ->useAttributeAsKey('name')
  278.                         ->prototype('array')
  279.                             ->children()
  280.                                 ->scalarNode('path')->defaultNull()->end()
  281.                                 ->scalarNode('domain')->defaultNull()->end()
  282.                                 ->scalarNode('secure')->defaultFalse()->end()
  283.                                 ->scalarNode('samesite')->defaultNull()->end()
  284.                                 ->scalarNode('partitioned')->defaultFalse()->end()
  285.                             ->end()
  286.                         ->end()
  287.                     ->end()
  288.                 ->end()
  289.             ->end()
  290.             ->arrayNode('switch_user')
  291.                 ->canBeUnset()
  292.                 ->children()
  293.                     ->scalarNode('provider')->end()
  294.                     ->scalarNode('parameter')->defaultValue('_switch_user')->end()
  295.                     ->scalarNode('role')->defaultValue('ROLE_ALLOWED_TO_SWITCH')->end()
  296.                     ->scalarNode('target_route')->defaultValue(null)->end()
  297.                 ->end()
  298.             ->end()
  299.             ->arrayNode('required_badges')
  300.                 ->info('A list of badges that must be present on the authenticated passport.')
  301.                 ->validate()
  302.                     ->always()
  303.                     ->then(function ($requiredBadges) {
  304.                         return array_map(function ($requiredBadge) {
  305.                             if (class_exists($requiredBadge)) {
  306.                                 return $requiredBadge;
  307.                             }
  309.                             if (!str_contains($requiredBadge, '\\')) {
  310.                                 $fqcn = 'Symfony\Component\Security\Http\Authenticator\Passport\Badge\\'.$requiredBadge;
  311.                                 if (class_exists($fqcn)) {
  312.                                     return $fqcn;
  313.                                 }
  314.                             }
  316.                             throw new InvalidConfigurationException(sprintf('Undefined security Badge class "%s" set in "security.firewall.required_badges".', $requiredBadge));
  317.                         }, $requiredBadges);
  318.                     })
  319.                 ->end()
  320.                 ->prototype('scalar')->end()
  321.             ->end()
  322.         ;
  324.         $abstractFactoryKeys = [];
  325.         foreach ($factories as $factory) {
  326.             $name = str_replace('-', '_', $factory->getKey());
  327.             $factoryNode = $firewallNodeBuilder->arrayNode($name)
  328.                 ->canBeUnset()
  329.             ;
  331.             if ($factory instanceof AbstractFactory) {
  332.                 $abstractFactoryKeys[] = $name;
  333.             }
  335.             $factory->addConfiguration($factoryNode);
  336.         }
  338.         // check for unreachable check paths
  339.         $firewallNodeBuilder
  340.             ->end()
  341.             ->validate()
  342.                 ->ifTrue(fn ($v) => true === $v['security'] && isset($v['pattern']) && !isset($v['request_matcher']))
  343.                 ->then(function ($firewall) use ($abstractFactoryKeys) {
  344.                     foreach ($abstractFactoryKeys as $k) {
  345.                         if (!isset($firewall[$k]['check_path'])) {
  346.                             continue;
  347.                         }
  349.                         if (str_contains($firewall[$k]['check_path'], '/') && !preg_match('#'.$firewall['pattern'].'#', $firewall[$k]['check_path'])) {
  350.                             throw new \LogicException(sprintf('The check_path "%s" for login method "%s" is not matched by the firewall pattern "%s".', $firewall[$k]['check_path'], $k, $firewall['pattern']));
  351.                         }
  352.                     }
  354.                     return $firewall;
  355.                 })
  356.             ->end()
  357.         ;
  358.     }
  360.     private function addProvidersSection(ArrayNodeDefinition $rootNode): void
  361.     {
  362.         $providerNodeBuilder = $rootNode
  363.             ->fixXmlConfig('provider')
  364.             ->children()
  365.                 ->arrayNode('providers')
  366.                     ->example([
  367.                         'my_memory_provider' => [
  368.                             'memory' => [
  369.                                 'users' => [
  370.                                     'foo' => ['password' => 'foo', 'roles' => 'ROLE_USER'],
  371.                                     'bar' => ['password' => 'bar', 'roles' => '[ROLE_USER, ROLE_ADMIN]'],
  372.                                 ],
  373.                             ],
  374.                         ],
  375.                         'my_entity_provider' => ['entity' => ['class' => 'SecurityBundle:User', 'property' => 'username']],
  376.                     ])
  377.                     ->requiresAtLeastOneElement()
  378.                     ->useAttributeAsKey('name')
  379.                     ->prototype('array')
  380.         ;
  382.         $providerNodeBuilder
  383.             ->children()
  384.                 ->scalarNode('id')->end()
  385.                 ->arrayNode('chain')
  386.                     ->fixXmlConfig('provider')
  387.                     ->children()
  388.                         ->arrayNode('providers')
  389.                             ->beforeNormalization()
  390.                                 ->ifString()
  391.                                 ->then(fn ($v) => preg_split('/\s*,\s*/', $v))
  392.                             ->end()
  393.                             ->prototype('scalar')->end()
  394.                         ->end()
  395.                     ->end()
  396.                 ->end()
  397.             ->end()
  398.         ;
  400.         foreach ($this->userProviderFactories as $factory) {
  401.             $name = str_replace('-', '_', $factory->getKey());
  402.             $factoryNode = $providerNodeBuilder->children()->arrayNode($name)->canBeUnset();
  404.             $factory->addConfiguration($factoryNode);
  405.         }
  407.         $providerNodeBuilder
  408.             ->validate()
  409.                 ->ifTrue(fn ($v) => \count($v) > 1)
  410.                 ->thenInvalid('You cannot set multiple provider types for the same provider')
  411.             ->end()
  412.             ->validate()
  413.                 ->ifTrue(fn ($v) => 0 === \count($v))
  414.                 ->thenInvalid('You must set a provider definition for the provider.')
  415.             ->end()
  416.         ;
  417.     }
  419.     private function addPasswordHashersSection(ArrayNodeDefinition $rootNode): void
  420.     {
  421.         $rootNode
  422.             ->fixXmlConfig('password_hasher')
  423.             ->children()
  424.                 ->arrayNode('password_hashers')
  425.                     ->example([
  426.                         'App\Entity\User1' => 'auto',
  427.                         'App\Entity\User2' => [
  428.                             'algorithm' => 'auto',
  429.                             'time_cost' => 8,
  430.                             'cost' => 13,
  431.                         ],
  432.                     ])
  433.                     ->requiresAtLeastOneElement()
  434.                     ->useAttributeAsKey('class')
  435.                     ->prototype('array')
  436.                         ->canBeUnset()
  437.                         ->performNoDeepMerging()
  438.                         ->beforeNormalization()->ifString()->then(fn ($v) => ['algorithm' => $v])->end()
  439.                         ->children()
  440.                             ->scalarNode('algorithm')
  441.                                 ->cannotBeEmpty()
  442.                                 ->validate()
  443.                                     ->ifTrue(fn ($v) => !\is_string($v))
  444.                                     ->thenInvalid('You must provide a string value.')
  445.                                 ->end()
  446.                             ->end()
  447.                             ->arrayNode('migrate_from')
  448.                                 ->prototype('scalar')->end()
  449.                                 ->beforeNormalization()->castToArray()->end()
  450.                             ->end()
  451.                             ->scalarNode('hash_algorithm')->info('Name of hashing algorithm for PBKDF2 (i.e. sha256, sha512, etc..) See hash_algos() for a list of supported algorithms.')->defaultValue('sha512')->end()
  452.                             ->scalarNode('key_length')->defaultValue(40)->end()
  453.                             ->booleanNode('ignore_case')->defaultFalse()->end()
  454.                             ->booleanNode('encode_as_base64')->defaultTrue()->end()
  455.                             ->scalarNode('iterations')->defaultValue(5000)->end()
  456.                             ->integerNode('cost')
  457.                                 ->min(4)
  458.                                 ->max(31)
  459.                                 ->defaultNull()
  460.                             ->end()
  461.                             ->scalarNode('memory_cost')->defaultNull()->end()
  462.                             ->scalarNode('time_cost')->defaultNull()->end()
  463.                             ->scalarNode('id')->end()
  464.                         ->end()
  465.                     ->end()
  466.                 ->end()
  467.         ->end();
  468.     }
  470.     private function getAccessDecisionStrategies(): array
  471.     {
  472.         return [
  473.             self::STRATEGY_AFFIRMATIVE,
  474.             self::STRATEGY_CONSENSUS,
  475.             self::STRATEGY_UNANIMOUS,
  476.             self::STRATEGY_PRIORITY,
  477.         ];
  478.     }
  479. }